As opposed to code that's already there. It could be running part of the game code. Deleting saved games, for instance. Getting control of the client applicat

As opposed to code that's already there. It could be running part of the game code. Deleting saved games, for instance. Getting control of the client application is different from pushing arbitrary code (any code the attacker want) on the machine and executing it. An in-between is return-oriented programming, where an attacker gains complete control over the execution flow of a given program. Even if they aren't able to push different code on the machine, they can chain parts of existing code to perform arbitrary computations on the machine: https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming